deploy: 0965f29

rfcs/starknet/stark.html

@@ -115,11 +115,14 @@ <h3>Interactive AIR Arithmetization</h3>
 <p>Furthermore, the columns of a table can be grouped, which allows the prover to fill the table group by group, using challenges from the verifier in-between. This is useful in order to perform an interactive arithmetization where parts of the encoded circuit needs verifier randomness to be computed.</p>
 <p>We give the example of two "original" columns and one "interaction" column, indexed using the multiplicative subgroup of the 16-th roots of unity:</p>
 <p><img alt="air" src="/RFCs/img/starknet/air.png" /></p>
-<p>Here one constraint could be to enforce that <code>col0[i] + col1[i] - col0[i+1] = 0</code> on every row <code>i</code> except the last one.</p>
-<p>As the columns of the table are later interpolated over the index domain, such constraints are usually described and applied as polynomials. So the previous example constraint would look like the following polynomial:</p>
+<aside class="example">Here one constraint could be to enforce that `col0[i] + col1[i] - col0[i+1] = 0` on every row `i` except the last one.
+
+As the columns of the table are later interpolated over the index domain, such constraints are usually described and applied as polynomials. So the previous example constraint would look like the following polynomial:
+
 <math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><mrow><mfrac><mrow><msub><mtext>col</mtext><mn>0</mn></msub><mo stretchy="false">&#x00028;</mo><mi>x</mi><mo stretchy="false">&#x00029;</mo><mo>&#x0002B;</mo><msub><mtext>col</mtext><mn>1</mn></msub><mo stretchy="false">&#x00028;</mo><mi>x</mi><mo stretchy="false">&#x00029;</mo><mo>&#x02212;</mo><msub><mtext>col</mtext><mn>0</mn></msub><mo stretchy="false">&#x00028;</mo><mi>x</mi><mi>&#x000B7;</mi><mi>w</mi><mo stretchy="false">&#x00029;</mo></mrow><mrow><msub><mi>D</mi><mn>0</mn></msub><mo stretchy="false">&#x00028;</mo><mi>x</mi><mo stretchy="false">&#x00029;</mo></mrow></mfrac></mrow></math>
 
-<p>where the domain polynomial <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"><mrow><msub><mi>D</mi><mn>0</mn></msub></mrow></math> can be efficiently computed as <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"><mrow><mfrac><mrow><msup><mi>x</mi><mrow><mn>16</mn></mrow></msup><mo>&#x02212;</mo><mn>1</mn></mrow><mrow><msup><mi>w</mi><mrow><mn>15</mn></mrow></msup><mo>&#x02212;</mo><mn>1</mn></mrow></mfrac></mrow></math>.</p>
+where the domain polynomial <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"><mrow><msub><mi>D</mi><mn>0</mn></msub></mrow></math> can be efficiently computed as <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"><mrow><mfrac><mrow><msup><mi>x</mi><mrow><mn>16</mn></mrow></msup><mo>&#x02212;</mo><mn>1</mn></mrow><mrow><msup><mi>w</mi><mrow><mn>15</mn></mrow></msup><mo>&#x02212;</mo><mn>1</mn></mrow></mfrac></mrow></math>.</aside>
+
 <p>The first phase of the Starknet STARK protocol is to iteratively construct the trace tables (what we previously called interactive arithmetization). The prover sends commitments to parts of the table, and receives verifier challenges in between.</p>
 <aside class="note">In the instantiation of the Starknet STARK protocol, there are only two execution trace tables: the original trace table and the interaction trace table, the verifier challenges received in between is called the interaction challenges. Different Cairo layouts will give place to different trace tables and interaction challenges.</aside>
 
@@ -138,7 +141,7 @@ <h3>Composition Polynomial</h3>
 <p>As we want to avoid having to go through many FRI checks, the verifier sends a challenge <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"><mrow><mi>&#x003B1;</mi></mrow></math> which the prover can use to aggregate all of the constraint quotient polynomials into a <strong>composition polynomial</strong> <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"><mrow><mi>h</mi><mo stretchy="false">&#x00028;</mo><mi>x</mi><mo stretchy="false">&#x00029;</mo><mi>:</mi><mo>&#x0003D;</mo><msub><mo>&#x02211;</mo><mrow><mi>i</mi><mo>&#x0003D;</mo><mn>0</mn></mrow></msub><mfrac><mrow><msub><mi>C</mi><mi>i</mi></msub><mo stretchy="false">&#x00028;</mo><mi>x</mi><mo stretchy="false">&#x00029;</mo></mrow><mrow><msub><mi>D</mi><mi>i</mi></msub><mo stretchy="false">&#x00028;</mo><mi>x</mi><mo stretchy="false">&#x00029;</mo><mi>&#x000B7;</mi><msup><mi>&#x003B1;</mi><mi>i</mi></msup></mrow></mfrac></mrow></math>.</p>
 <p>This composition polynomial is quite big, so the prover provides a commitment to chunks or columns of the composition polynomials, interpreting <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"><mrow><mi>h</mi></mrow></math> as <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"><mrow><mi>h</mi><mo stretchy="false">&#x00028;</mo><mi>x</mi><mo stretchy="false">&#x00029;</mo><mo>&#x0003D;</mo><msub><mo>&#x02211;</mo><mi>i</mi></msub><msub><mi>h</mi><mi>i</mi></msub><mo stretchy="false">&#x00028;</mo><mi>x</mi><mo stretchy="false">&#x00029;</mo><msup><mi>x</mi><mi>i</mi></msup></mrow></math>.</p>
 <aside class="note">In the instantation of this specification with Cairo, there are only two composition column polynomials: <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"><mrow><mi>h</mi><mo stretchy="false">&#x00028;</mo><mi>x</mi><mo stretchy="false">&#x00029;</mo><mo>&#x0003D;</mo><msub><mi>h</mi><mn>0</mn></msub><mo stretchy="false">&#x00028;</mo><mi>x</mi><mo stretchy="false">&#x00029;</mo><mo>&#x0002B;</mo><msub><mi>h</mi><mn>1</mn></msub><mo stretchy="false">&#x00028;</mo><mi>x</mi><mo stretchy="false">&#x00029;</mo><mi>&#x000B7;</mi><mi>x</mi></mrow></math>.</aside>
-<p>.</p>
+
 <p>Finally, to allow the verifier to check that <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"><mrow><mi>h</mi></mrow></math> has correctly been committed, Schwartz-Zippel is used with a random verifier challenge called the "oods point". Specifically, the verifier evaluates the following and check that they match:</p>
 <ul>
 <li>the left-hand side <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"><mrow><msub><mo>&#x02211;</mo><mrow><mi>i</mi><mo>&#x0003D;</mo><mn>0</mn></mrow></msub><mfrac><mrow><msub><mi>C</mi><mi>i</mi></msub><mo stretchy="false">&#x00028;</mo><mtext>oods_point</mtext><mo stretchy="false">&#x00029;</mo></mrow><mrow><msub><mi>D</mi><mi>i</mi></msub><mo stretchy="false">&#x00028;</mo><mtext>oods_point</mtext><mo stretchy="false">&#x00029;</mo></mrow></mfrac><mi>&#x000B7;</mi><msup><mi>&#x003B1;</mi><mi>i</mi></msup></mrow></math> </li>

source/starknet/stark.md

@@ -56,13 +56,13 @@ We give the example of two "original" columns and one "interaction" column, inde
 
 ![air](/img/starknet/air.png)
 
-Here one constraint could be to enforce that `col0[i] + col1[i] - col0[i+1] = 0` on every row `i` except the last one.
+<aside class="example">Here one constraint could be to enforce that `col0[i] + col1[i] - col0[i+1] = 0` on every row `i` except the last one.
 
 As the columns of the table are later interpolated over the index domain, such constraints are usually described and applied as polynomials. So the previous example constraint would look like the following polynomial:
 
 $$\frac{\text{col}_0(x) + \text{col}_1(x) - \text{col}_0(x \cdot w)}{D_0(x)}$$
 
-where the domain polynomial $D_0$ can be efficiently computed as $\frac{x^{16} - 1}{w^{15} - 1}$.
+where the domain polynomial $D_0$ can be efficiently computed as $\frac{x^{16} - 1}{w^{15} - 1}$.</aside>
 
 The first phase of the Starknet STARK protocol is to iteratively construct the trace tables (what we previously called interactive arithmetization). The prover sends commitments to parts of the table, and receives verifier challenges in between.
 
@@ -88,7 +88,7 @@ As we want to avoid having to go through many FRI checks, the verifier sends a c
 
 This composition polynomial is quite big, so the prover provides a commitment to chunks or columns of the composition polynomials, interpreting $h$ as $h(x) = \sum_i h_i(x) x^i$.
 
-<aside class="note">In the instantation of this specification with Cairo, there are only two composition column polynomials: $h(x) = h_0(x) + h_1(x) \cdot x$.</aside>.
+<aside class="note">In the instantation of this specification with Cairo, there are only two composition column polynomials: $h(x) = h_0(x) + h_1(x) \cdot x$.</aside>
 
 Finally, to allow the verifier to check that $h$ has correctly been committed, Schwartz-Zippel is used with a random verifier challenge called the "oods point". Specifically, the verifier evaluates the following and check that they match: